{"id":74201,"date":"2020-03-15T08:42:28","date_gmt":"2020-03-15T05:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu"},"modified":"2020-03-15T08:42:28","modified_gmt":"2020-03-15T05:42:28","slug":"chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","title":{"rendered":"DDR4 memorijski \u010dipovi ostaju podlo\u017eni napadima RowHammer, unato\u010d dodanoj za\u0161titi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Group of researchers from the Vrije Universiteit Amsterdam, ETH Zurich, and Qualcomm izveli su<\/a><\/noindex> study the effectiveness of DDR4 memory protection against class attacks RowHammer<\/a><\/noindex>, which allow changing the contents of individual bits in dynamic random-access memory (DRAM). The results were disappointing, and DDR4 chips from major manufacturers remain ostaju<\/a><\/noindex> vulnerable (CVE-2020-10255<\/a><\/noindex>). <\/p>\n

The RowHammer vulnerability allows the contents of individual memory bits to be distorted by cyclically reading data from neighboring memory cells. Since DRAM memory is structured as a two-dimensional array of cells, each consisting of a capacitor and a transistor, continuous reading of the same memory area leads to voltage fluctuations and anomalies that cause a slight loss of charge in neighboring cells. If the reading intensity is high enough, a cell may lose a significant amount of charge, and the next refresh cycle will not be able to restore its original state, resulting in a change in the data stored in the cell. <\/p>\n

To block such an effect, modern DDR4 chips employ TRR (Target Row Refresh) technology, designed to prevent cell distortion during a RowHammer attack. The issue is that there is no unified approach to implementing TRR, and each CPU and memory manufacturer interprets TRR differently, applying their own protection variants and not disclosing implementation details.
\nIstra\u017eivanje metoda blokiranja RowHammer koje koriste proizvo\u0111a\u010di omogu\u0107ilo je lako pronala\u017eenje na\u010dina zaobila\u017eenja za\u0161tite. Prilikom provjere ispostavilo se da se prakticirani princip proizvo\u0111a\u010da «security by obscurity<\/a><\/noindex> \" in the implementation of TRR only helps for protection in specific cases involving typical attacks that manipulate the changes in charge of cells in one or two neighboring rows. <\/p>\n

Alat razvijen od strane istra\u017eiva\u010da omogu\u0107ava provjeru osjetljivosti \u010dipova na vi\u0161estruke varijante RowHammer napada, u kojima se poku\u0161ava utjecati na napla\u0107ivanje vi\u0161e redaka memorijskih \u0107elija istovremeno. Ovi napadi omogu\u0107uju zaobila\u017eenje za\u0161tite TRR koju su implementirali neki proizvo\u0111a\u010di i dovode do o\u0161te\u0107enja bitova memorije \u010dak i na novoj opremi s DDR4 memorijom.
\nOd 42 prou\u010davana DIMM modula, 13 modula pokazalo se ranjivima na nesvakida\u0161nje na\u010dine provo\u0111enja RowHammer napada, unato\u010d najavljenoj za\u0161titi. Problemati\u010dne module proizveli su SK Hynix, Micron i Samsung, \u010diji proizvodi \u010dine<\/a><\/noindex> 95% tr\u017ei\u0161ta DRAM-a.<\/p>\n

Osim DDR4, prou\u010deni su i \u010dipovi LPDDR4 koji se koriste u mobilnim ure\u0111ajima, koji su tako\u0111er pokazali osjetljivost na pro\u0161irene varijante RowHammer napada. Konkretno, podlo\u017ena problemu bila je memorija koja se koristi u Google Pixel, Google Pixel 3, LG G7, OnePlus 7 i Samsung Galaxy S10 pametnim telefonima.<\/p>\n

Istra\u017eiva\u010di su uspjeli reproducirati nekoliko tehnika eksploatacije na problemati\u010dnim DDR4 \u010dipovima. Na primjer, primjena RowHammer-aeksploita<\/a><\/noindex> za PTE (Unosi Tablice Stranica) zahtijevala je da napad traje od 2,3 sekunde do tri sata i petnaest sekundi, ovisno o testiranim \u010dipovima. Napad<\/a><\/noindex> za o\u0161te\u0107enje pohranjenog RSA-2048 otvorenog klju\u010da trajala je od 74,6 sekundi do 39 minuta i 28 sekundi. Napad<\/a><\/noindex> za zaobila\u017eenje provjere ovlasti putem modifikacije memorije procesa sudo trajala je 54 minute i 16 sekundi.<\/p>\n

Za provjeru korisni\u010dkih DDR4 memorijskih \u010dipova objavljen je alat TRRespass<\/a><\/noindex>. Za uspje\u0161nu provedbu napada potrebne su informacije o fizi\u010dkom adresnom rasporedu primijenjenom u memorijskom kontroleru, u vezi s bankama i redovima memorijskih \u0107elija. Za odre\u0111ivanje rasporeda dodatno je razvijen alat drama<\/a><\/noindex>, koji zahtijeva pokretanje s root pravima. U najskorije vrijeme bit \u0107e tako\u0111er planira<\/a><\/noindex> objavljena aplikacija za testiranje memorije pametnih telefona.<\/p>\n

Tvrtki Intel<\/a><\/noindex> i AMD<\/a><\/noindex> preporu\u010deno je da se za za\u0161titu koristi memorija s ispravkom gre\u0161aka (ECC), memorijski kontroleri s podr\u0161kom za Maksimalni Broj Aktivacija (MAC) i primjena pove\u0107ane u\u010destalosti regeneracije. Istra\u017eiva\u010di smatraju da za ve\u0107 proizvedene \u010dipove ne postoji rje\u0161enje za garanciju za\u0161tite od Rowhammer-a, a primjena ECC-a i pove\u0107anje u\u010destalosti regeneracije memorije pokazali su se neu\u010dinkovitima. Na primjer, ranije je ve\u0107 predlo\u017eeno metoda<\/a><\/noindex> napada na DRAM memoriju zaobi\u0107i ECC za\u0161titu, kao i mogu\u0107nost napada na DRAM kroz lokalnu mre\u017eu<\/a><\/noindex>, iz gostuju\u0107eg sustava<\/a><\/noindex> i uz pomo\u0107<\/a><\/noindex> izvr\u0161avanje JavaScript-a u pregledniku.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438 \u0447\u0438\u043f\u044b DDR4 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b (CVE-2020-10255). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RowHammer \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74201","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DDR4 memorijski \u010dipovi ostaju ranjivi na RowHammer napade, unato\u010d dodatnoj za\u0161titi | ProHoster","description":"Group of researchers from the Vrije Universiteit Amsterdam, ETH Zurich, and Qualcomm","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0438\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 DDR4 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a RowHammer, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/chipy-pamyati-ddr4-ostayutsya-uyazvimy-dlya-atak-rowhammer-nesmotrya-na-dobavlennuyu-zashhitu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-15T05:42:28+00:00","article:modified_time":"2020-03-15T05:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:19:29","updated":"2022-09-30 02:28:33","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/74201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=74201"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/74201\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=74201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=74201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=74201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}